f2d3bf6928cbae8d6c3ec0ab4d6c6e8c57bf2d17fe310e39dd8c2bc8b83cc0e8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
Size 691KB
Sample260910-e9pw8sgj8s
SHA256 f2d3bf6928cbae8d6c3ec0ab4d6c6e8c57bf2d17fe310e39dd8c2bc8b83cc0e8
MD5 7dbc02e5f490a9800e859e07fcba4acf
SHA1 91ab8cb4734f03ebd223e4cd7aa30d99401c5a10
SHA512 93a92f5dabeca8d7d227803e1afd478755736d9f71ee8efd900bffd69642d51adc1328407d72e4924ec7e4a34141fa7edbab2cf57fa93ebeb9ad77e69ebdf239
SSDEEP 6144:mNfw1NI9tL9nQElxgh91zfa2uLLj6Ckgx3o+wsJ09xJTtP7/F30h1tJ5Jt+nj:mNfwknRlqhnz1O1x3o+Fi9M7t9Wj
TLSH
T186E4D451ABA449B1F0B299348975865CAB327C55CD23CE0F20959EDEFFF39808D25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\T:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\Y:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\Z:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\V:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\W:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\X:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\A:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\K:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\O:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\P:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\Q:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\G:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\H:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\I:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\J:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\M:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\S:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\U:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\B:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\E:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\L:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened (read-only)	\??\N:	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7dbc02e5f490a9800e859e07fcba4acf_icedid_njrat_ryuk.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3552-1-0x000001ADBB4A0000-0x000001ADBB4A5000-memory.dmp

Download

memory/3552-0-0x00007FF70C080000-0x00007FF70C124000-memory.dmp

Download

memory/3552-6-0x000001ADBB4A0000-0x000001ADBB4A5000-memory.dmp

Download

memory/3552-3-0x000001ADBB4A0000-0x000001ADBB4A5000-memory.dmp

Download

memory/3552-2-0x000001ADBB480000-0x000001ADBB486000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads